Lucene search

[email protected]NVD:CVE-2016-7191

HistorySep 28, 2016 - 8:59 p.m.

CVE-2016-7191

2016-09-2820:59:00

CWE-287

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.006

Percentile

78.5%

JSON

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

Affected configurations

Nvd

Node

microsoftazure_active_directory_passportMatch1.0.0

microsoftazure_active_directory_passportMatch1.1.0

microsoftazure_active_directory_passportMatch1.1.1

microsoftazure_active_directory_passportMatch1.2.0

microsoftazure_active_directory_passportMatch1.3.0

microsoftazure_active_directory_passportMatch1.3.1

microsoftazure_active_directory_passportMatch1.3.2

microsoftazure_active_directory_passportMatch1.3.3

microsoftazure_active_directory_passportMatch1.3.4

microsoftazure_active_directory_passportMatch1.3.5

microsoftazure_active_directory_passportMatch1.3.6

microsoftazure_active_directory_passportMatch1.4.0

microsoftazure_active_directory_passportMatch1.4.1

microsoftazure_active_directory_passportMatch1.4.2

microsoftazure_active_directory_passportMatch1.4.3

microsoftazure_active_directory_passportMatch1.4.4

microsoftazure_active_directory_passportMatch1.4.5

microsoftazure_active_directory_passportMatch2.0.0

VendorProductVersionCPE
microsoftazure_active_directory_passport1.0.0cpe:2.3:a:microsoft:azure_active_directory_passport:1.0.0:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.1.0cpe:2.3:a:microsoft:azure_active_directory_passport:1.1.0:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.1.1cpe:2.3:a:microsoft:azure_active_directory_passport:1.1.1:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.2.0cpe:2.3:a:microsoft:azure_active_directory_passport:1.2.0:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.3.0cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.0:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.3.1cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.1:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.3.2cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.2:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.3.3cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.3:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.3.4cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.4:*:*:*:*:*:*:*
microsoftazure_active_directory_passport1.3.5cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	azure_active_directory_passport	1.0.0	cpe:2.3:a:microsoft:azure_active_directory_passport:1.0.0:::::::*
microsoft	azure_active_directory_passport	1.1.0	cpe:2.3:a:microsoft:azure_active_directory_passport:1.1.0:::::::*
microsoft	azure_active_directory_passport	1.1.1	cpe:2.3:a:microsoft:azure_active_directory_passport:1.1.1:::::::*
microsoft	azure_active_directory_passport	1.2.0	cpe:2.3:a:microsoft:azure_active_directory_passport:1.2.0:::::::*
microsoft	azure_active_directory_passport	1.3.0	cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.0:::::::*
microsoft	azure_active_directory_passport	1.3.1	cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.1:::::::*
microsoft	azure_active_directory_passport	1.3.2	cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.2:::::::*
microsoft	azure_active_directory_passport	1.3.3	cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.3:::::::*
microsoft	azure_active_directory_passport	1.3.4	cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.4:::::::*
microsoft	azure_active_directory_passport	1.3.5	cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.5:::::::*